2

I'm reversing an old video game with large number of shared libraries, and in order to reference them all correctly (via "thunk" functions?) I think I need to import all of the raw files into the same program tree. I've tried using analyzeHeadless to import all of the shared libraries into the project, but I don't see way to place them into an existing program using that tool (it instead creates a new program for each file). Let me know if I'm doing something wrong.

2
  • The dialog calls ImporterUtilities.addContentToProgram(), which calls Loader.loadInto(). I'll write up a full answer once I get my attempt working May 13, 2021 at 15:45
  • Actually I wanted this for ELFs, but ElfLoader doesn't support it. So I won't be finishing my attempt, but maybe the pointer to the relevant methods is helpful May 14, 2021 at 19:40

1 Answer 1

1

Are they raw files loaded by special mechanisms or typical .so or .dll shared objects? Given the dll tag I am assuming you are concerned about .dll files.

On importing a program for the first time you can select Options Picture of the "Import $filename" dialog

and then activate "Load External Libraries" enter image description here

Configure the paths properly via Edit Paths. enter image description here

The paths are searched for shared libraries that are specified as imports in actual program you are importing. If you have already imported the program you can still fix this with ELF files as described in this issue but for some reason there is no premade script for PE files, i.e. .dlls. There might still be a way to do this manually though, the idea is just to also have imported the relevant DLL file so you can link it to a program that requires it as an external library. The relevant functions will then be properly linked.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.